* Posts by Trevor_Pott

6175 posts • joined 31 May 2010

Rise up against Oracle class stupidity and join the infosec strike

Trevor_Pott
Gold badge

Re: Nice idea

@charles 9: plenty of other professions have codes of conduct, ethical standards and we have legislation to enforce this.

It's only every man for himself in really shitty parts of the world, mate. Like Somalia. Or the US of NSA. In much of the rest of the world - the good parts of the world - people are raised with a belief in a duty of care to their society.

But I've noted your Randian worldview and made the appropriate push of the ignore button. Good bye.

0
3
Trevor_Pott
Gold badge

Re: Be careful out there kids....

@AC: If they won't listen to you and implement security as a priority then there's fuck all you can do. Being there won't give you power to magically make it better. Leaving - especially if the why of it is explained to the right people - may well make them realize the importance of security. Especially if enough do it.

As for If some unknown sysadmins quit, or developers, who would notice? that depends on who finds out. As a generally rule, if you're good at your job, people internal to the company notice. And if enough people (or high ranking) people leave a company for this reason the press notices. And this is what is ultimately required.

They will just thank the whiner went away, so they could work as they like

If this is the kind of attitude that not only your company but your peers within that company have then you are in a really shitty workplace. If they view you as a "whiner" for having professional ethics what makes you think that their apathy about corporate or professional duty of care will somehow end at treating the customer like a commodity? If they treat others like shit they are going to treat you like shit and you need to get the hell out of there ASAP.

Do you believe answering "I quitted each of them because my colleagues/managers were morons who didn't care about IT security" will help you?

Hell yes it would, at any place that actually worth my time and effort.

0
2
Trevor_Pott
Gold badge

Just because the US of NSA has allowed itself to deteriorate doesn't make it civilized. It's not. It's a shithole. An uncivilized shithole that is losing any shred of decency it may once have had.

If my country follows, it too won't be fit to call civilized either. Civilizations work collaboratively for the good their people. The US of NSA gave that up some time ago. As is very clearly evidenced by the unrepentant - even proud - selfishenss of some of the commentards here.

I've never been more disappointed in humanity than I am today.

0
2
Trevor_Pott
Gold badge

Re: Nice idea

If "Following Orders" is the only way to put food on the table, ethics kind of takes second priority.

That worldview is fucking appalling. Jesus H mother of goddamned donkeyfucking christ, what the hell happened to us that we've forgotten so much, so fast?

Holy wow. Just wow.

2
5
Trevor_Pott
Gold badge

Re: Be careful out there kids....

You mean something like this?

0
0
Trevor_Pott
Gold badge

Re: Easy to bitch about other people's work

Bad IT in a car can indeed kill people.

Bad IT in planes has killed people.

Bad IT in medical equipment has killed people.

Bad IT in AI-equipped auto-death weapons inevitably will kill people.

And on and on and on....

2
0
Trevor_Pott
Gold badge

Re: will it really help?

Assuming your take on things to be correct, how is it rational to take a job knowing that there will be a lax attitude to security, this will lead to security breaches and you, as the minion "just following order" will be the schlub on the hook to take the blame?

How is it rational to say "I'll take some easy money now, knowing that there is a really good risk that shit will hit the fan, I'll get blamed, and end up unemployable in this field forever after that point"? Wouldn't it make more sense to put your labour into another profession where you can actually expect long term employment, instead of an abrupt, messy - and potentially expensive - sacking, followed by being reverted to essentially "unskilled labour"?

0
2
Trevor_Pott
Gold badge

We'll have to agree to disagree, Charles 9; I don't consider shitholes particularly civilized. I mean, look at the US of NSA...

1
0
Trevor_Pott
Gold badge

Re: Be careful out there kids....

@AC Well, at least you're honest. That's not really much of a consolation, but there is that one, small redeeming quality.

0
1
Trevor_Pott
Gold badge

Re: Nice idea

I think did answer it: because, apparently, IT is filled with people perfectly willing to put their own desires before the lives of others. Just shrug off any responsibility. You're just following orders.

Nice.

0
4
Trevor_Pott
Gold badge

That's not a civilized country. That's a shithole.

0
0
Trevor_Pott
Gold badge

I disagree. Legislation to make information security failures the responsibility of the executive layer personally would stop this almost overnight. The other alternative would be legal recognition of professional associations and banning individuals from working in the field who weren't members. Those associations would then boot out anyone who didn't follow ethical guidelines.

Engineering in civilized countries functions this way. It's time to apply this to development, and IT in general.

4
0
Trevor_Pott
Gold badge

Re: Nice idea

So..fuck the customer, the population at large and everyone, everywhere, only you and your job matter?

Sorry, but this one is actually worth fighting for. And it is worth organizing professional associations for. And worth putting time and effort into.

Or maybe you just want to wait until the price of individual selfishness and cowardice on behalf of developers is measured in bodies. How many people's lives is your job worth? Hmm? How many injuries and maimings does it take before you exit your comfort zone? How many people need to face financial ruination before you speak out?

or do you somehow think that, because you're "just following orders" you aren't to blame? That it's only the fault of the higher-ups who pushed back on you over and over to get it done quicker, and you folded like a cheap tent every time?

Do you feel you bear no responsibility whatsoever for the results of your work?

0
2
Trevor_Pott
Gold badge

Re: Be careful out there kids....

You're absolutely correct. It can get you fired. So you have to make the choice: do you care only about yourself? Or do you have a responsibility to others? I argue that we all have a responsibility to others not to let companies ignore security. Even if it cost us our jobs.

If we were able to make professional ethics a legal requirement for our professions they wouldn't be able to fill those positions with people willing to break with ethics for corporate profit. Not if they wanted to be allowed to keep practicing, anyways.

A combination of legislation and a unified stance is required for this to work.

0
2
Trevor_Pott
Gold badge

Re: Easy to bitch about other people's work

Who is asking they be fixed "in a week"? The issue is taking information security seriously and doing everything reasonably possible to ensure that it not be given lip service only. For a company Oracle's size, that absolutely includes bug bounties.

But bug bounties aren't the real issue. The Oracle-class stupidity is bemoaning user and researcher attempts to discover bugs in the first place. The concept that a company's need to protect its intellectual property and/or near-monopoly with an EULA should come before security is not only assinine, it is dangerous.

Oracle has been pretty clear about putting security far behind commercial interests for a very long time now. This lady has just been the first to be honest about it. And they threw her under the yacht for doing so!

If yoru software is so awful that you have a "line of CVSes to fix" then you should be out there, fixing those. They shouldn't stay unfixed for ages. And you shouldn't be objecting to people adding new ones to the list.

More to the point, you should have layers of QA, proper unit tests and proper security testing before things go out so that the number of CVSes starts dropping over time.

I don't expect any company to magically solve all security problems over night. I don't expect all code to be without flaw. I absolutely do expect companies - especially large ones - to make security the primary priority. Ahead of new features. Ahead of release dates. Ahead of any other priority in their software.

Corporate profit should not come before information security, especially for vendors as large (and profitable) as Oracle. The hell of it is that it doesn't take a whole lot of investment to resolve this. For a company Oracle's size adding a few hundred extra bodies to security testing design and then to QA (those who implement the tests) and drawing out releases a little so that the bugs can be solved before going out...that's nothing.

And throwing a few measly million at the research community to find bugs in your software is a minor expense for an Oracle. Especially since the stuff the researchers find is going to be the same stuff so easily visible to blackhats using those very same techniques.

Nobody should get to avoid responsibility for security just because they believe they have a $deity-given right to ignore security in the quest for money.

3
1
Trevor_Pott
Gold badge

Re: Real geeks roll their own home routers.

Well, I use OpenWRT. So that's upgradable. Not everyone is allowed to do this, however. My ISP, for example, usually freaks out if you don't use their shitty Actiontec modem/gateways. I was able to score an appropriate VDSL2 modem-only unit from ebay and put my own router behind it. But what if I had had an Actiontec? I can't really do much to it. I'd be entirely at the mercy of the ISP.

This is a really bad situation.

0
1
Trevor_Pott
Gold badge

Re: will it really help?

Actually, we are working on HTTPS for all our sites. (There are about 12, including trevorpott.com)

The issue we're facing is one of limited IP addresses. I know that HTTPS should work with multiple sites to a single IP on newer browsers, but I would really like to ensure that we have backwards compatibility support. So I'm in the process of evaluating load balancers and how it is they might (or might not) solve the problem.

In the meantime, we have (to my knowledge) removed from all our sites any member sign-ups on publicly published pages. We have informed our existing members that we're looking to alter our entire security stance on the sites, including eventually altering where the login pages are, switching to .hta access and more.

We've been mostly working on behind the scenes security in the past month. Database and operating system hardening. Automated updates for Wordpress. Security plugin testing and hardening for wordpress. Selective writelock cascades for any site which doesn't have to be writable for that particular timeframe...we've also gone over the code and the databases to make sure we weren't pwned at any point in the past.

Because we aren't in the process of building an active forum presence that requires readers to sign up or subscribe, bur primary focus from a security standpoint has been to ensure that we aren't hosting malicious stuff that could infect readers. HTTPS support is on the list in the near term, but as the sites are (at the moment) publicly facing read-only (rather than interactive) sites, we felt the other security issues had priority.

If you feel there is a really good reason to push HTTPS above the rest of our security efforts to get it done sooner, please, make your case! We're entirely open to it!

2
1
Trevor_Pott
Gold badge

Re: will it really help?

Hence why I think both legislation and grassroots nerdrage are required. Corporates are not going to give fucks without both things occurring.

4
1
Trevor_Pott
Gold badge

Re: will it really help?

Fortunately, I don't have to make that choice. The Register is, in fact, working on HTTPS support (or so I have been told). But you know what? Yeah. In the long run, if I couldn't convince them that it mattered - especially for a technology site! - I'd probably take my content elsewhere. I don't want to, but I really do think ethics matter.

Someone has to say "no, I won't take that job". I've started to do just this with some of my sysadmin clients. I think it's valid to think about it applying to writing, too.

There is room for discussion about taking things to extremes though. If your employer is making headway and clearly working on the problem, it's probably not going to help anything if you pull the rip cord. But if they just stubbornly don't care about their customers to the point that they ignore security why would you believe they give a bent damn about you?

But before we can hammer out these sorts of fine details we need to start having the discussion about infosec professional ethics in the first place. Glad to see some readers are willing to join in.

3
2
Trevor_Pott
Gold badge

Re: Rise up Techie Introverts and be ...

Yep. That's a big problem right there. I don't really have a solution to that. Maybe it requires an extrovert to start taking a stand so the rest will follow. Maybe it requires massive encouragement across the industry. Maybe social media can help. But we need to get everyone - even the introverts - to stop allowing badness to ensue through apathy. If anyone comes up with magical solutions to motivate, I'd love to hear them! :)

2
2
Trevor_Pott
Gold badge

Re: First, I stand for TLS, not SSL.

Hah! Fair point. I think of TLS as "SSL" even though I know the difference. Same purpose, same libraries, same modules...guess I'm just getting old; conflating things that are "close" because of implementation rather than provenance.

3
1

Cisco network kit warning: Watch out for malware in the firmware

Trevor_Pott
Gold badge

Re: Holy *crap*

I'm no expert on switches, but couldn't you require that ROMMON images be signed?

2
0

Police use RIFLE AND TASER to relieve man of iPhone case

Trevor_Pott
Gold badge

Re: stupid Canadian volunteers to give away rights

I can carry my guns around. In a locked case. With the ammunition in a separate locked case. This is the correct mode of transportation for firearms, just as it is the correct storage method for firearms.

I can unlock my firearms in my own residence if I take appropriate security precautions. This allows me to clean and maintain these devices.

It is not recommended (and is in most cases illegal) to unlock both the firearm and the ammunition at the same time excepting in designated areas such as firing ranges, or designated hunting grounds.

You are not allowed to acquire or retain firearms unless you have a license for that class of weapon. In order to get a firearms license you must learn and demonstrate understanding of firearm safety, including (but not limited to) all of the above.

This is exactly how firearms should be treated. It is sane. It is rational. It allowes Canada to maintain a higher per capita gun ownership than the United States without anywhere near as many firearms-related deaths (intentional or otherwise.)

Philosophies on the ownership and utilization of firearms which are less safety oriented have proven outright disastrous for those nations which have employed them. When dealing with firearms safety come first last and always.

44
4

IT touts cough up $6m for flogging 'overpriced' PCs to US nuke boffins

Trevor_Pott
Gold badge
Unhappy

So whistleblowers that make the government money get paid a portion of the proceeds. Whistleblowers that detail how the government is eradicating the rights of it's own people go to prison.

Excellent priorities.

5
1

BlackBerry can't catch a break: Now it's fending off Jeep hacking claims

Trevor_Pott
Gold badge

A) OCZ chose to use Sandforce

B) OCZ handled the whole even completely fucking atrociously and they deserved to have been run out of business for that. It is a crime against consumers that they were purchased.

OCZ purchased something from a supplier, put it together and sold it to customers. It was defective. They denied this up and down and then they were awful to customers. Even after it was undeniable, they continued to be terrible. Sorry mate, there is absolutely nothing defensible about OCZ. One of the worst, most awful storage companies in all of tech history, full stop.

2
0
Trevor_Pott
Gold badge

OCZ didn't take a huge hit for selling bad flash. They took a huge hit for denying the issue repeatedly and loudly and treating victims of the flaw like shit. OCZ were (and who knows, maybe still are) run by utter twatdangles and how they handled the whole affair will end up in multiple text books about how not to do things in the modern world. Or any world.

Ever.

4
0

Texas senator Ted Cruz serves up sizzling 'machine gun bacon'

Trevor_Pott
Gold badge

Re: The republican clown car.

The same Carly who demanded that Apple, Google et al simply give up all user data without a fight?

So many flavours of fuck you if you support her. Fuck you in flavours.

9
0

Nutanix digs itself into a hole ... and refuses to drop the shovel

Trevor_Pott
Gold badge

I have considered it. I have given their testing methodologies a cursory overview based on what they make available publicly and found that the results I can achieve with those methods more or less line up with what they publish.

The whole incident has piqued my interest for deeper research, however, and I am hoping to pursue this behind the scenes with them over the coming weeks. I have a call scheduled with them at the end of the week, hopefully I'll learn more.

Overall, however, their results have tended to be among the most "realistic" I've seen. They most closely match the "real world tests" that I do; tests that tend to be around 1/3rd the headline achievable IOPS or throughput, usually because real world tests aren't 100% one (IOPS) or the other (throughput).

This confusion is also why many of us in the testing community really do want an open, affordable, standardized set of tests that the industry as a whole can agree upon.

1
1
Trevor_Pott
Gold badge

Re: A few points...

Again, you are mistaken that this as is all about you. This isn't your lawn and your aren't a part of The Register, you write guest contributed, unpaid content and you comment on the message boards.

I'm not a part of The Register? I have 418 articles published here. I've been writing here for over 5 years. At what point are you "part of" a publication, hmm?

Also: my articles are unpaid? That's news to me. And my bookkeeper. And my 4 employees. Because it seems to me we invoice The Register for rather a lot of money. Which is nice. As it does things like pay our mortgages.

It's a hot topic and you want to wave your flag, we get it.

It's a boring topic that the overwhelming majority of Register readers don't give a flying fuck about. Some do, but there's only about 800K - 1M that seem to care enough to poke their noses in on this, and fewer still who care to comment.

And again, you're wrong, I really don't want to "wave my flag" here. People like you whoa re assholes on the internet, make it a very unpleasant topic to write about. I've gotten death threats because I have written something that someone doesn't like; most of the negative feedback begin from the zealots that inhabit the storage industry.

I don't even like storage. I got sucked into being a storage blogger/analyst/whatever-the-fuck-I-am entirely against my will. And once sucked in, I learned fast. Now people see me as "knowledgeable" on the topic and seek me out at an ever increasing rate for advice.

But I hate storage. I really, really do. It's boring and the people are mean.

There are much better things to write about. Things that actually interest me. DevOps. SDN/NFV. Compute hardware. Above all else: security. These are my actual passions. They also "get the clicks" as it were.

Sadly, storage needs a shit disturber or twenty. Your own douchetastic response is exactly why. Zealotry and misinformed ad homenim too often take the place of reasoned discourse, as your perpetual firehose of haterade so ably demonstrates.

But it's not even necessary, you have a voice here and you post regularly on The Register. I'm not trying to shut you up, I'm simply suggesting you chill out and let others chime in without sucking all of the oxygen out of the room by responding to every single comment.

But you are trying to shut me up. That is exactly what you are doing. You feel somehow that you, personally, have a right to dictate when and where I should be allowed to speak. What gives you the right to determine the context of my speech? And why shouldn't I be allowed to participate in discussions both from an official platform (as a writer for The Register) and from an unofficial platform (as a commenter on The Register)?

The various mediums available to me - numerous places where I publish my articles, Twitter, my own personal blog, various comments sections, forums and message boards - all offer me the chance to approach topics in various ways. Some allow me to advance my personal opinion in a more unbridled fashion than others. Some have a mass audience while some a more select one.

There is an entire internet available for you to vent your hate and spew forth opprobrium. Yet here you are, on my digital lawn, trying to tell me what to do.

Given the context there is only one appropriate response: go fuck yourself, asshole.

And maybe, just maybe, you should actually add something useful to the conversation. If anything is sucking the oxygen out of the room it is your worthless personal attacks and pitiful demands for censorship.

The route to people valuing your opinions is to contribute something meaningful, not restricting who can talk until yours is the loudest voice left. If your ego needs satiating, satisfy it somewhere else.

2
1
Trevor_Pott
Gold badge

Re: The shady truth of the storage industry

I also just want to back up what Satinder is saying. Tintri have been absolutely amazing about testing their units. They've given me a completely free hand. (I hope to have the review out this Monday, as a matter of fact.)

I have found some flaws with Tintri's implementation. But I've found a crazy amount of good. Tintri has not shackled me with restrictions on testing or on publishing. They've let me toss a unit into production, run every synthetic I can on it, and abuse it in every way. They've made an SE available to me for any questions and shown me how they prefer to benchmark things, but not insisted this be the only path.

I've learned a lot about storage from them. Just as I have from every really good storage company I've worked with. They have fantastic engineers who have taken the time to get really in depth on things I don't understand, or flat out get wrong.

(Side note: I will disagree with Satinder on the utility of SQLIO. Even full of 0s, it's great for testing the network portion of shared storage, and it is also possible to replace the all-0s file with a randomly-generated one so that you are hammering with more than just 0s. I find it a useful tool, if used correctly. That said, Tintri's "Tingle" load generator is actually pretty cool, and a useful item that the whole industry should be using.)

Another thing that Satinder said is important here: education. Of customers and of reviewers. You can't review storage properly if you honestly think you have nothing new to learn. Each storage offering is different. Not only that, but tools to generate and test load are constantly evolving.

Many vendors - like Tintri - do an excellent job of educating, so it behooves anyone (customer or reviewer) who is doing testing to really listen through the various presentations.

The truth is that there is a lot of good storage out there. Hyperconverged, scale out, object and legacy alike. There are a lot of great companies peddling that storage. More to the point, the market for storage is huge, and continually growing.

We shouldn't need to have the petty rivalries that have developed, or be getting bogged down in who is allowed to review what by which means. We should be educating people as to which test are best to simulate (or test) what components of storage. We should be verifying our synthetics with real world workloads. And we should all be absolutely open and honest about the results because it is how we all - vendor, reviewer and customer alike - learn, adapt, and ensure the next round of products are better than the last.

1
1
Trevor_Pott
Gold badge

Re: The shady truth of the storage industry

@Virtualgeek: great response. Truly. I have nothing negative to say to that, it's absolutely spot on. It's why I insist on running real world test with workloads I know inside and out (from having run them for 11+ years in production) alongside the benchmarks. There's a lot more to testing storage than synthetics. (See; iSCSI microburst issues with switches; something we don't have standardized tests for yet!)

1
1
Trevor_Pott
Gold badge

Re: E-mail reply from Chuck Hollis of VMware

1) "Profane" language can be used for either emphasis or to provoke a response. It works well in both cases.

2) "Profane"? What era are you from? What was it like watching them invent the steam engine?

3) Yes, I like arguing. Especially with people who like to jump right in on personal attacks.

4) There are rather a lot of people on these forums who post on behalf of their employers. There are also a bunch who are irrational brand tribalists. I see no reason to treat either category as anything other than hostile.

By all means, post things I disagree with. In case you didn't notice, I not only admit that I can be wrong, I tend to point out where and when I feel it is possible that I am wrong, and I will even post information from external sources when I feel that information has come to light which brings my own dialogue into question. (See: posting Chuck's e-mail as an example).

Just because I don't think you are right about your inane blitherings - or that I troll you because you're a douche - doesn't mean I am somehow unaware of my own fallibility or am unwilling to admit it. It really just means I think you haven't clue one what you, personally, are prattling on about.

Also: fuck, shit, ass, and cockmongling cuntpotato! Just because you like the profane.

*Smoochie boochies*

1
2
Trevor_Pott
Gold badge

@Alan Brown

There is a difference between "difficult to work with" from a technology side and "difficult to work with" from a people side. Lots of companies have decent-to-good tech but miserable people. Plenty of companies have middling-to-miserable tech but great people.

Great tech can make up for miserable people and great people can make up for miserable tech. The exact mixture that works for one company may not work for another because requirements for uptime, support responsiveness an other such things can vary dramatically.

The biggest warning sign I can give is to take a good look at the executive layer. Especially of small companies. If the executives - most critically the CEO and CTO - are "high touch" individuals, you're in trouble. The worst thing in tech is an engineer CEO who won't let the various division heads (sales/marketing/QA/channel/etc) do their jobs unhindered.

High-touch CEOs are a screaming alarm bell warning about oncoming icebergs.

Tech is a tricky business, and I find more companies getting the "people" part of it wrong than those that get it right. Oddly enough, getting the "technology" part right seems easy. There are lots of companies with great technology. It is in managing staff, customer and community expectations - and coping with extremes of emotion from all sides - that tech companies fall down.

Unfortunately, too many in tech think that "the human factor" is irrelevant. Until, of course, it isn't. At which point it's probably too late.

0
1
Trevor_Pott
Gold badge

I'm sorry that I don't have a "valid, scientific definition", but I do have this. It's the closest I've come to trying to explain the marketing terms and the history surrounding them. I hope it helps.

1
1
Trevor_Pott
Gold badge

Bingo

Nail on the head. And this is why I feel that more than just synthetics are required for a full testing suite to be accurate for this space. Maybe you should be out there doing testing, eh?

1
1
Trevor_Pott
Gold badge

Re: A few points...

Including this comment, there are 30 comments on this board. ****11 are from Trevor**** WTF?

It's really not that hard to understand: The Register is my digital lawn. I've been a commenttard - and quite frankly, troll - about these parts for roughly a decade. That gold badge my posts sport? Only 10 of us have them.

In addition, I write for The Register, so I have even more reason to hang out on the forums. Add in the fact that storage and virtualization have been my areas of research and specialty for the past 3-ish years and, actually, it would be pretty odd if I weren't all over this like white on rice.

Now, normally, I'd make a few pithy comments and leave. Some people made replies worth replying to, so that ups my count a bit.

Now you, you seem to get angry if I post. I"d say I'm sorry you don't like me, but the truth of it is you're really quite being a dick, so I'm actually quite happy that I upset you. It's not like someone is forcing you to read the forums. Or The Register. Or to sit in front of the computer at all.

It's not like you are forced to acknowledge my existence or tolerate my opinions. You have infinite choices regarding how you might ignore me. You can shape and craft your own world so that no dissenting opinions enter your consciousness.

Hell, there are seven billion people on this planet: you can choose to shape your whole life such that you never encounter any opinion that you don't like. You choose to put yourself in situations where you are exposed to ideas and individuals who upset you.

And so, I'm going to keep posting. You don't intimidate me. You don't shame me. You don't make me feel guilty. But it's absolutely crystal clear that I have struck a nerve. And that means I should keep digging, because the more ardently someone wants me to not talk about something the more important is usually is that I do.

Cheers, and thanks for helping me set my research priorities for the next several months.

I'll be sure to be quite loud about broadcasting my results.

5
1
Trevor_Pott
Gold badge

Re: A few points...

If you deride someone by name then go on to attempt to deride others without listing their names it helps for clarity to either be explicit that you aren't continuing your derision of the first person or to clarify whom you are now deriding.

It's also generally considered good form to use your real name when you deride someone, otherwise you really do just come across as nothing more than a petty Anonymous Coward.

Also: this "message board"? It's my back yard. I'll do what I like on my own lawn mate. Go get your own.

1
2
Trevor_Pott
Gold badge

Re: Testing shmesting ..

Perhaps Trevor could do an article on the benchmarks in question, and how well what they tested reflected the sorts of things which customers actually cared about.

Well, I was going to. But both VMware and Nutanix have potentially disruptive offerings coming out in the near term. I think I'll wait until those land, then throw a month or two at it.

2
2
Trevor_Pott
Gold badge

Re: One for the weekend -

Ceph. Oh god. So many brokens. So much slow. So much potential. So terrible right now.

3
1
Trevor_Pott
Gold badge

Re: A few points...

1) Trevor, great feedback but this isn't about you. You have the benefit of writing a post on The Register any time you want so I don't understand why you would empty your laundry on a message board. Grow up.

Why would this be about me? Where did I say it was about me? In pretty much every single post in this thread I have stated explicitly that I am a nobody and that I both understand if vendors don't want me to test things and am entirely okay with that, so long as there are other, more important, and - most critically - credible independent testers who are allowed to do the testing.

I don't see how relating my experiences makes this "about me". It is simply providing more data.

If you average all the readers I have across all the places I write I have an audience of about 15 million. That may not be a lot, but it's enough that I could have been much louder and more dickish about this issue. Still, I felt that the discussion needed - and does need - to be had.

I know from experience that if I reply to a major article in The Register those comments will be read by relevant people at those companies. Social media teams are actually quite good these days. So I chose this method because of the limited scope of impact it would have while still getting my point across to the relevant people. It seems like an acceptable compromise.

2) About the test: VMmark (the test Storage Review uses) is a VERY GOOD measure of real world environments and is as close as you are going to get in a test environment. Those who say you cannot effectively test for real world results are spewing vendor FUD. You clearly haven't used VMmark.

Where did I say VMmark wasn't good? It's not the be-all and end-all of tests, but it sure is a great synthetic! I heartily approve of its use as one part of a larger suite of tools.

3) Nutanix response to the testing is abhorrent and they deserve all the backlash they get. It speaks about the company, their technology, their culture and yes, their employees. There is never a shortage of Nutanix employees talking badly about the competition and, like roaches, they disappear when the light is cast on them.

VMware is not remotely immune to talking smack about competitors...even when they aren't willing or able to fully back it up. The whole industry is a clusterfuck of egotism and douchebaggery.

Hence the need for independent testing.

P.S. If you're going to cast aspersions on someone have the genitals to use your real name.

5
2
Trevor_Pott
Gold badge

Re: E-mail reply from Chuck Hollis of VMware

Might it be so that because, in your own words, you are a nobody, that both Nutanix and VMware don't really want to spend valuable marketing $$'s on you performing tests that no sizeable crowd is ever going to read?

Absolutely. I 100% accept this as plausible, and I don't honestly take issue with either or both companies deciding that I am irrlevant.

I absolutely do take issue with them not working with the more important members of the independant testing community, and I haven't talked at all here about what they tell me about interacting with either company.

This is just my polite way of saying that you maybe should tone it down a little?

And as such I'm not basing my purchases on FUD from any website, or person but just test the stuff myself before any PO leaves my desk.

Where did I ask you to base anything you're doing on what I wrote here? I asked that you - and everyone else - test for yourselves. I asked that you ask hard questions. I am listing here my issues, just as others are starting to do, in the hopes that when it comes time for you to make purchasing decisions you take the time to remember these events and you to a more rigorous POC than maybe you otherwise would have done.

This isn't about my ego. Nobody with self-esteem as low as I have can really have much of an ego. This is honestly about just wanting to do well by others. I'm sorry you feel offended by that.

If I'd wanted to make a gigantic mess out of this I could have posted an article on The Register and put this in front of 9 million readers. As it is, less than 1% of The Register's readership uses the comments section.

By choosing to talk about this in the comments section of an article I know that the major players at both companies - as well as most of the independent testing community - will read, I am restricting the impact of my being shouty whilst still making my point to the right people.

2
2
Trevor_Pott
Gold badge

We'll have to disagree here. I don't believe VMware are going to be in the pole position, because I don't believe VMware have an awareness of the market required to make the cultural changes that will allow them to take that position. Nutanix, for all their flaws, are the dominant play by a country frigging mile. And they are not lax. You seem to have a real hate on for them, but there's nothing at all to indicate they will crumple up and die, as you seem to hope.

1
3
Trevor_Pott
Gold badge

E-mail reply from Chuck Hollis of VMware

Chuck Hollis of VMware has read this comment thread and sent me an e-mail. His opinion and views on the matter - and on my comments above - are valid and deserve to be included in this dicussion. I am reproducting the e-mail chain here.

Chuck Hollis to Trevor Pott

Hi Trevor

It was interesting to read your recent comments on The Register regarding the latest Nutanix snafu.

But I think you've completely mis-understood (and mis-represented) our stance on performance testing. We encourage it, not discourage it.

We've published oodles of our own data. We've published data from customers. We've encouraged StorageReview.com to publish. Etc. etc. etc. The more the merrier.

All we ask is a chance to review the configs and methodologies prior to publication -- which has been VMware's policy for many, many years. Lots of people are new to this testing thing.

We plan to release an easy-to-use testing tool (based on VDbench) to help make it easier for folks to test hyperconverged clusters with a variety of IO profiles. You, of course, are free to use it -- as will anyone else.

Or use your own tools. Have at it -- really!

However, we don't have much of a budget to send people free hardware. We're tapped out for the year, unfortunately, so you'd have to round up your own four-node config that conformed to the VMware VSAN HCL and design guidelines. Dell may be willing to play, or perhaps HP or similar.

Nor do we generally pay for reviews, as that's a slippery slope.

I hope you understand our position here, and can perhaps soften some of your comments to more accurately reflect reality?

Thanks!

-- Chuck

Trevor Pott to Chuck Hollis (reply)

While your take on this does not reflect my experiences with VMware in this regard. We appear to have dramatically different understandings of the meaning of "chance to review the configs and methodologies prior to publication". I view independent reviewing – especially of software solutions like VSAN – to be fair game if you test multiple options on the same hardware. Doubly so if the individual components are on the HCL.

VMware seems to disagree, and has insisted that individual components being supported isn't good enough: the whole of the thing must meet the desired qualities. Slower CPUs, for example, are apparently not okay.

That said, I don't have to agree with your take on this for it to be valid. I have my view and I have expressed it. It is entirely possible that my views or understanding is wrong, and I'm willing to admit that possibility.

I will publish your e-mail in the comments as it is entirely valid that you get the change to rebut what I have said, along with this response. The readers will decide.

For the record: I never wanted – and don't really want – extra hardware to do testing. I will absolutely test whatever hardware comes my way, but for the love of $deity I have 10x as much server widgetry as I could ever conceivably use. I've also not asked to be paid for reviews by you or by Nutanix. I've offered several times to do independent testing for free in order to help put this debate to rest.

What I want – all I've ever wanted – is the chance to test hardware, software and services that I think my readers or my clients (or preferably both) will care about. I want to dig to find the truth of the gear that real systems administrators use, because it is those sysadmins that I feel a kinsip with, and it is those sysadmins that I feel I serve.

Parting thoughts

It is worth discussing the issues surrounding vendor control over reviews via an exercise of their legal rights. I believe it is perfectly valid for VMware to want to review the configuration and methodology of a review of their software. I don't believe, however, that they should have the opportunity to deny things just because they won't show that software in the best possible light.

It is absolutely valid to test non-optimal configurations and report the results of that testing. In the real world, lots of people live outside pre-canned, certified solutions. HCLs exist for a reason: they are a recognition of this fact and a publicly visible list of not just entire servers that are certified, but individual components, for those who are colouring outside the lines a little.

I view VMware's VSAN team as spectacularly hard to work with in a way that the rest of VMware isn't, specifically because of the level of control they insist on having over reviews. VMware's VSAN team don't seem to view their efforts as an attempt at control, but as an attempt at quality assurance and review integrity.

If I am being honest, then I cannot say that I have the answer to which view is right. My views are deeply rooted in my own past as an SMB sysadmin, which is tied to a need to know how things work when you can't afford to pay top dollar (and high margins) for everything. I feel that is a world that needs to be quantified, and I spend most my year trying to answer those questions for other sysadmins.

VMware's views are influenced by their own needs, but I must admit their take is objectively no less valid. I think readers should read all of this. Not just this thread, but many of the other threads that are associated on various blogs across the virtualization blogosphere.

I am one voice with one set of experiences. There are other voices with other points of view. Decide for yourselves. Test for yourselves.

I look forward to using both VMware and Nutanix's testing tools in my future HCI testing just as soon as they become generally available.

9
2
Trevor_Pott
Gold badge

Re: Howard Marks?

Storage Howard Marks has a mightier beard than Weed Howard Marks.

Also a wizard hat. The wizard hat is important.

3
3

We can give servers more memory, claims Diablo. Well, sort of

Trevor_Pott
Gold badge

Holy hell

There are still Netlist shills.

Will you people let it go? You lost. Do you really need to drag your sorry, wrecked egos through the mud again, chasing after Diablo jumping up and down trying to lash out? FFS, just let Netlist crawl into a corner and die with whatever pathetic shreds of dignity it has left.

You hardcore Netlist believers are about as crazy as the two people who believe SCO's bullshit and try to convince the world of it. Find a new religion. Yeesh.

0
1

Fancy 10 Gbps home broadband? Broadcom's built the guts of it

Trevor_Pott
Gold badge

I'll eat a $30K install cost if they keep the bandwidth costs down to something sane. Unfortunately, they want thousands of dollars per month 10Mbit continuous use. Fucking madness.

1
1
Trevor_Pott
Gold badge

Re: WHY WHY WHY

WHY WHY WHY can't I buy a 10Mbit upload for less than $500 a month, or $5,000 a month is I want to actually use the bandwidth?

0
1
Trevor_Pott
Gold badge

Re: 10Gbs fibre to 4*1Gbs ethernet

The questions is more how to make a service like this pay.

Simple. You charge $250 a month for "access to" the 10Gbit fibre, with a "generous" "free" bandwidth allocation of 100GiB. Then you charge them $50/TB over the limit. If they complain, you have them rounded up as terrorists and thrown in jail.

Yes, I live in a country where protesting is illegal and can be classified as terrorism at the prime minister's whim.

0
1

Sane people, I BEG you: Stop the software defined moronocalypse

Trevor_Pott
Gold badge

Re: A better analogy

In Canada you get your license taken away for a minimum of 6 years, get a large fine and go to jail. Increasingly there are zero tolerance rules, especially if you have a GDL instead of a full license.

0
0
Trevor_Pott
Gold badge

So you want us to just turn off the internet and pretty much our entire manufacturing and power generating capacity, not to mention all of our tanks, jets, warships, satellites and our entire bloody society?

That'll go over well...

5
2

Forums